Pay or Consent Models in Europe: Already Outdated or an Overlooked Crisis in Freely Given Consent?

Pay or Consent Models in Europe: Already Outdated or an Overlooked Crisis in Freely Given Consent? Abstract The transition from free digital services to paid models has sparked significant debate, particularly concerning the Pay or Consent model which allows users to either pay for services or consent to data processing. Drawing on decisions and guidelines from the Court of Justice of the European Union (CJEU), data protection authorities, and the European Data Protection Board (EDPB), the paper explores both normative and practical questions. It evaluates whether a uniform approach across all online service providers is feasible, or whether a differentiated model depending on the power imbalance is more appropriate. In doing so, it also raises a critical, yet underexplored issue: how to determine a “appropriate fee” that preserves user autonomy without undermining the principle of voluntariness. 1. Introduction As the internet became an integral part of daily life, rumours about free digital services turning into paid ones have persisted as myths 1 . Fake notifications claiming that online messaging applications, email 1. Let’s recall a nostalgic message that visited many people’s inboxes in the 2000s: “Will you forward this message? Because MSN Messenger will become paid as of August 1st; however, if you forward this message to 12 people, it will remain free for you! This is not a joke (if you don’t believe it, check msn.com). If you forward this email to 12 people, your MSN icon will turn blue.” Similarly, in 2015, a hoax about Facebook announced that the platform would start charging users £5.99 to keep their posts private unless they copied and pasted a specific message on their page. See The Guardian, ‘No, Facebook isn’t going to charge to keep people’s posts private’ available at https://www.theguardian.com/technology/2015/sep/30/facebook-charge-keep-posts-private- hoax Accessed 28 June 2025. Author(s) Nafiye Yücedağ, Elif Beyza Akkanat Öztürk, Şehriban İpek Aşıkoğlu Contact nyucedag@istanbul.edu.tr, eba@istanbul.edu.tr, ipekasikoglu@istanbul.edu.tr Affiliation(s) Nafiye Yücedağ is an Associate Professor in the Civil Law Department at Istanbul University Faculty of Law. Elif Beyza Akkanat Öztürk is an Assistant Professor in the Department of Private Law (Comparative Law Department) at Istanbul University Faculty of Law. Şehriban İpek Aşıkoğlu is a doctoral researcher in corporate law at Istanbul University Faculty of Law. Keywords Pay or Consent, GDPR, tracking technologies, cookies, prohibition of bundling, appropriate fee Published Received : 26 Mar 2025 Accepted : 10 Jul 2025 Published : Citation Nafiye Yücedağ, Elif Beyza Akkanat Öztürk, Şehriban İpek Aşıkoğlu, Pay or Consent Models in Europe: Already Outdated or an Overlooked Crisis in Freely Given Consent?, Technology and Regulation , 2025, 336-354 • 10.71265/8jjzhc21 • ISSN: 2666-139X 337 TechReg 2025.016 Pay or Consent Models in Europe services, and similar platforms would soon require payment attracted the attention of internet users for a period. The primary aim of these messages was to mislead users, drawing them into extended email exchanges and ultimately exploiting their personal information. In the early 2000s, such misinformation campaigns were frequently encountered, serving as tools that abused the trust of internet users. Today, while the credibility of these fake messages seems to have diminished, the question of whether free digital services will become paid has resurfaced. The Pay or Consent model, emerging in the European Union, reshapes digital rules and sparks debates. This model, which allows users to either pay for a service or give consent to data processing, has raised significant concerns in the field of data protection law. A key legal challenge of the Pay or Consent model lies in assessing whether the consent obtained from users meets the requirement of being freely given under data protection law 2 . This question is especially complex when the alternative to consenting is the payment of a fee that may not be economically accessible to all users. Against this backdrop, the study seeks to explore the following fundamental question: How should the criterion of freely given consent be evaluated within the context of Pay or Consent models? Given the novelty and evolving nature of Pay or Consent models, and considering the EDPB’s opinion on large online platforms, is it feasible to adopt a uniform approach across all service providers, regardless of the power imbalance? A closely related question concerns the notion of a “appropriate fee” that has often been overlooked or insufficiently conceptualised. In the absence of clear criteria, what is deemed reasonable may risk normalising disproportionate economic burdens, effectively legitimizing structural inequality. If access to privacy-preserving services becomes conditional upon the ability to pay, there is a real risk of creating a de facto two-tiered digital society: one where economically privileged user can maintain their privacy by paying, while others are compelled to surrender personal data as the price of entry. This article follows a chronological structure to trace the evolution of Pay or Consent models and the corresponding legal and regulatory developments. The chronological structure adopted in this article reflects the layered and evolving nature of the legal debate surrounding Pay or Consent models. It enables a clearer understanding of how regulatory attention has shifted over time, from initial ambiguity and fragmented enforcement to more assertive interventions, thereby allowing for a contextualised assessment of both legal interpretation and policy direction regarding the freely given nature of consent. The article begins by outlining the legal challenges and broader contextual factors that have contributed to the emergence of Pay or Consent models (Section 2). It then examines the evolving interpretation of the freely given element of consent under EU data protection law, drawing on the guidance of the Article 29 Working Party, the EDPB, and key rulings of the CJEU, all of which have significantly influenced the legal framework applicable to Pay or Consent models (Section 3). Section 4 evaluates how national data protection authorities have responded to the implementation of Pay or Consent by online newspapers and offers a comparative analysis of their decisions and reasoning within the context of freely given consent. Section 5 analyses Opinion 08/2024 of the EDPB, particularly the Trio Model it introduces, alongside Meta’s response and subsequent developments, and considers whether the regulatory position taken in the context of dominant platforms like Meta can or should be extended to other digital services. Section 6 offers a critical reflection on the broader implications of these regulatory developments, particularly in relation to power imbalance and appropriate fees. It argues that, before introducing structural revisions to Pay or Consent mechanisms, greater analytical attention should be given to assessing the voluntariness of consent under existing models, with particular emphasis on the power imbalance, appropriateness of the fee. The conclusion highlights unresolved questions, particularly concerning what constitutes an appropriate fee, that require further legal and empirical investigation. 2. See also Gareth Davies, ‘Consent or Pay: Transforming Internet Users from Products into Customers’ (2025) EuCML 1, 6, 7. 338 TechReg 2025.016 Pay or Consent Models in Europe 2. Legal Challenges of Business Models Based on Behavioural Advertising: The Evolution of Pay or Consent Models Personal data has become an asset 3 and the ability to process personal data is key to economic activity. Numerous business models shaping economic and social life are financed through the processing of personal data. Legal relationships are increasingly formed in exchange for personal data, either explicitly or implicitly, for example, when service providers offer free services, often under a freemium model, in return for personal data 4 . Many revenue models, especially those of companies like Meta Platforms and Google , rely on the processing of their users’ personal data to display targeted ads through tracking technologies. Personal data is one of the key pillars of these businesses 5 . This business model is not limited to large online platforms; many online service providers similarly fund their offerings through the monetization of personal data. In such business models, some service providers made and some still make the processing of personal data a prerequisite for delivering the service, requiring the consent of the data subject 6 . However, the approach of the European authorities towards the concept of “consent” in particularly the voluntary nature of it has led service providers to seek and develop alternative models over time 7 . The emergence of Pay or Consent models is closely tied to the European Union’s General Data Protection Regulation (GDPR) 8 , 2002/58/EC Directive 9 and the interpretations of data protection authorities, which have imposed strict requirements for obtaining user consent for processing personal data. Under Directive 2002/58/EC, activities involving the storage or access of information on a subscriber’s or user’s terminal equipment -through tracking technologies- require the user’s/subscriber’s consent. Although a 2009 amendment to Article 5 of Directive 2002/58/EC shifted the framework from an opt-out system to one based on consent, the enforcement of consent in cookie policies gained significant momentum in 2018 with the implementation of the GDPR 10 . Meanwhile, websites exhibited varying practices regarding cookies 11 , before the CJEU’s Planet49 decision in 2019 12 . It was common to rely on mechanisms such as pre-ticked checkboxes or the assumption that continuing to use a website constitutes acceptance of cookies. In the Planet49 case, the Court ruled that consent cannot be validly obtained through a pre-checked checkbox that the user must deselect. 3. Christiane Wendehorst, ‘Die neuen Regelungen im BGB zu Verträgen über digitale Produkte’ (2021) 40 NJW 2913, 2913. 4. Contractual relationships that are established in exchange for (personal) data without any monetary consideration are referred to as the “freemium model”. See also Chris Anderson, Free-The Future of Radical Price (Random House Business Books 2009) 19 ff; Dirk Staudenmayer, ‘2019/770, Art 3’ in Reiner Schulze and Dirk Staudenmayer (eds), EU Digital Law: Article-by-Article Commentary (Nomos 2020) para 52. 5. Benedikt Buchner, ‘Die Einwilligung im Datenschutzrecht-vom Rechtfertigungsgrund zum Kommerzialisierungsinstrument’ (2010) 1 DuD 39, 39; Despite all the data protection controversies and legal challenges, Meta’s global advertising revenue has steadily increased over recent years, as highlighted by Statista (Statista, ‘Werbeeinnahmen von Facebook weltweit’ https://de.statista.com/statistik/daten/studie/170421/umfrage/werbeeinnahmen-von-facebook-weltweit/ Accessed 28 June 2025). 6. Behavioural advertising data processing activities were long claimed to be conducted by platforms under the legal bases of GDPR Article 6(1)(b) and GDPR Article 6(1)(f ). However, these discussions appear to have lost their intensity following the CJEU’s decision in the Meta Platforms case. See also Case C-252/21 Meta Platforms Ireland Limited v Bundeskartellamt [2023] ECLI:EU:C:2023:325. EDPB, ‘Guidelines 05/2020 on Consent under Regulation 2016/679’ (Version 1.1, Adopted 4 May 2020) paras 38-41. 7. Article 29 Working Party, ‘Guidelines on Consent under Regulation 2016/679’ (adopted 28 November 2017, revised and adopted 10 April 2018) 10. See also, Max von Grafenstein and Nina Elisabeth Herbort: ‘Regulation of Online Advertising’ (Federation of German Consumer Organisations (2024), 54. 8. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC. 9. Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications). 10. Article 5(3) of Directive 2002/58/EC covers not only cookies but also similar tracking technologies. 11. Article 29 Working Party, ‘Working Document 02/2013 providing guidance on obtaining consent for cookies’ (adopted 2 October 2013) 2. 12. Case C-673/17 Planet49 GmbH v Bundesverband der Verbraucherzentralen und Verbraucherverbände [2019] ECLI:EU:C:2019:801. 339 TechReg 2025.016 Pay or Consent Models in Europe This requirement of active behaviour of consumer led the common use of cookie walls 13 . However, the interpretation of the GDPR, alongside subsequent guidelines and opinions issued by data protection authorities, has significantly tightened the rules regarding cookie consent mechanisms 14 . As cookie walls became increasingly criticized or and regarded as unlawful, service providers began searching for alternative monetization models that could ensure compliance while preserving revenue. In this context, the emergence of Pay or Consent models can be seen as a direct strategic response to the limitations placed on cookie wall mechanisms. Unlike cookie walls, which offer users a “singular” choice -accept tracking or leave- these models introduce a second option: users can choose not to be tracked by paying a fee. One of the earliest examples of this model involved an Austrian newspaper which introduced a Pay or Consent model, requiring users to either consent to tracking or pay a fee to avoid it 15 . Similarly, The Washington Post introduced three access options to users: (1) free, limited articles with tracking-based ads; (2) paid, unlimited access with tracking; or (3) a premium subscription with unlimited access, no ads, and no tracking. By the early 2020s, renowned European publishers such as Le Monde in France and DER SPIEGEL in Germany adopted similar systems, further refining the approach by bundling the pay option with features like ad-free access or premium content 16 . A significant acceleration in the adoption of Pay or Consent models occurred in 2021 in France 17 , coinciding with the enforcement of stricter cookie guidelines by the French Data Protection Authority (CNIL) 18 . These regulations mandated clear, explicit, and informed user consent for tracking technologies. The shift spurred many French publishers to adopt Pay or Consent model as a compliance and monetization strategy 19 . In addition, major online platforms have begun adopting these models. For instance, Meta has adjusted its strategy for the European market by introducing a subscription-based alternative to tracking for Facebook and Instagram users 20 . As seen, paid alternatives have emerged alongside the so-called “free” option, which relies on obtaining consent for personal data processing. However, this raises concerns about whether the pay option genuinely 13. The term “cookie wall” refers to the practice where, upon visiting a website, a notification appears that blocks access to the website’s content. In this notification, visitors are asked to give consent for non-essential cookies in order to view the site’s content. EDPB (n 6) 12. 14. On September 29, 2020, CNIL issued the final version of its guidelines on the use of cookies and other trackers, replacing a first draft published on July 4, 2019, available at https://www.cnil.fr/fr/cookies-et-autres-traceurs/regles/cookies/lignes-directrices- modificatives-et-recommandation Accessed 28 June 2025. CNIL has also published non-binding recommendations on how to implement the Guidelines in practice. Délibération n° 2020-092 du 17 septembre 2020 portant adoption d’une recommandation proposant des modalités pratiques de mise en conformité en cas de recours aux «cookies et autres traceurs», available at https://www.cnil.fr/sites/cnil/files/atoms/files/recommandation-cookies-et-autres-traceurs.pdf Accessed 28 June 2025; ICO, ‘Guidance on the rules on use of cookies and similar technologies, Privacy and Electronic Communications Regulations’ (2019) 30. The EDPB has updated its guidelines on consent to address the need for further clarification regarding the validity of consent provided by data subjects when interacting with so-called “cookie walls.”, EDPB (n 6) 4. For insights into the guidelines and enforcement actions issued by other data protection authorities, see also Cristiana Santos, Nataliia Bielova and Célestin Matte, ‘Are cookie banners indeed compliant with the law?’ (2020) Technology and Regulation 91-135. 15. Timo Müller-Tribbensee, Klaus Miller and Bernd Skiera, ‘Paying for Privacy: Pay-or-Tracking Walls’ (5 March 2024) 2 https://papers. ssrn.com/sol3/papers.cfm?abstract_id=4749217 Accessed 28 June 2025. 16. Müller-Tribbensee, Miller, and Skiera’s study investigates the prevalence of pay-or-tracking walls among top publishers in 21 European countries. Using web scraping, manual classification, and privacy policy reviews, the study finds that these mechanisms are notably employed by leading publishers in Austria, France, Germany, and Italy. The findings highlight that pay-or-tracking walls are implemented with diverse designs, often bundling the pay option with features such as reduced tracking and advertising-free access. Müller-Tribbensee et al (n 15) 37. 17. Müller-Tribbensee et al (n 15) 15. 18. On September 30, 2020, CNIL issued revised guidelines and final recommendations on the use of cookies and similar tracking technologies. For further details, see CNIL’s official publication available at https://www.cnil.fr/fr/cookies-et-autres-traceurs/ regles/cookies/FAQ Accessed 28 June 2025. 19. See Müller-Tribbensee et al (n 15) 1 ff. The study also notes that, as of November 2022, pay-or-tracking walls were employed by the top 50 publishers in Austria, France, Germany, and Italy. The proportion of publishers utilizing such walls was highest in France (20%), followed by Germany (18%), and Austria and Italy (10% each). 20. See infra, 5. New Era: Trio Model? 340 TechReg 2025.016 Pay or Consent Models in Europe constitutes an equivalent and meaningful alternative to consent, thereby ensuring that consent is truly freely given. 3. Freely Given Consent: Legal Interpretation and Practical Implications Against the backdrop of Pay or Consent models, it is essential to understand how the concept of freely given consent has evolved in EU data protection law, as this legal interpretation has significantly shaped the emergence and design of such models. Recital 42 of the GDPR emphasizes that consent cannot be deemed freely given if the data subject lacks a genuine or free choice or faces adverse consequences for refusing to consent or withdrawing their consent 21 . The notion of consent being based on free will does not imply that withholding consent must be entirely without negative consequences 22 . However, such consequences must be proportionate and directly related to the purpose of the data processing to ensure they do not undermine the validity of the consent 23 . Both Article 29 Working Party 24 and EDPB 25 sets up the following criteria to be considered to assess the freely given nature of consent: i. imbalance of power, whether there is a power imbalance between the data subject and the data controller that might undermine the voluntariness of consent, ii. conditionality, whether the provision of a service is conditional on providing consent for data processing that is not strictly necessary for the service, iii. granularity: whether consent is specific and given separately for distinct processing activities, iv. detriment : whether the data subject faces any negative consequences for refusing or withdrawing consent. Importantly, these criteria are applied cumulatively and, on a case-by-case basis. The initial debates surrounding Pay or Consent models primarily focused on the issue of conditionality within the meaning of Article 7(4) GDPR, especially under the Article 29 Working Party and EDPB evaluations. Over time, the concepts of power imbalance and appropriate fee have gained prominence as primary considerations, and their implications have also become a significant factor in the assessment of conditionality. This evolution will be clearly seen below through the approaches of data protection authorities 26 . 3.1 Evaluations of the Article 29 Working Party The concept of consent has been clarified through opinions issued by the Article 29 Working Party 27 . The Article 29 Working Party emphasizes that consent is valid only when the data subject can make a genuine, voluntary choice, free from any risk of deception, intimidation, coercion, or significant negative consequences for refusing to provide it 28 . In updating its previous opinion on the definition of consent following the enforcement of the GDPR, the Article 29 Working Party highlighted the importance of Article 7(4) in ensuring that consent is freely given. Examining the issue under the concept of conditionality, the Article 29 Working Party stated that conditioning the provision of a service on obtaining consent for data processing that is not strictly necessary for the performance of the contract or service constitutes an undesirable practice 29 . In its opinion, the Article 29 Working Party stated that, in such cases, it is presumed that consent 21. GDPR Recital 42 (5th sentence): “ Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment ”. 22. Kirsten Johanna Schmidt, Datenschutz als Vermögensrecht: Datenschutzrecht als Instrument des Datenhandels (Springer Verlag 2020) 87. 23. Botschaft zur Änderung des Bundesgesetzes über den Datenschutz (DSG) und zum Bundesbeschluss betreffend den Beitritt der Schweiz zum Zusatzprotokoll vom 8. November 2001 zum Übereinkommen zum Schutz des Menschen bei der automatischen Verarbeitung personenbezogener Daten bezüglich Aufsichtsbehörden und grenzüberschreitende Datenübermittlung (BBl 2003 2101, 2127) https://links.weblaw.ch/BBl-2003-2101 Accessed 28 June 2025; Schmidt (n 22) 87. 24. Article 29 Working Party (n 7) 9. 25. EDPB (n 6) 8 paras 16 ff. 26. See also 4. Assessments of the Online Newspaper’s Pay or Consent Model: Approach of Data Protection Authorities 27. Article 29 Working Party, ‘Opinion 15/2011 on the definition of consent’ (adopted 13 July 2011); Article 29 Working Party (n 7) 9. 28. Article 29 Working Party (n 27) 12; Article 29 Working Party (n 7) 3. 29. Article 29 Working Party (n 7) 7. 341 TechReg 2025.016 Pay or Consent Models in Europe is not freely given 30 . Referring to the term “ presumed ” in Recital 43 of the GDPR 31 , the Article 29 Working Party emphasized that such instances would be highly exceptional 32 . According to the Article 29 Working Party consent may be valid if data subjects are offered a genuine choice between a service requiring consent for additional data processing and an equivalent service that does not 33 . However, both services must be truly equivalent and provided by the same provider. Consent is not considered freely given if the choice relies on equivalent services 34 offered by other service providers, as this would depend on external market conditions and impose an undue burden on controllers to monitor their competitors. Such an argument fails to meet GDPR requirements for valid consent 35 . This statement of the Article 29 Working Party clarified that the monopol contract approach, primarily advocated by German scholars 36 , is not endorsed. A monopol contract exists when all service providers in the relevant market make the fulfilment of the service provider’s obligations conditional on consent to the processing of personal data 37 . According to this view, if a data subject has the option to choose between service providers but selects one that conditions service provision on consent to data processing, it is regarded as a free choice. If a data controller operates in a monopoly or holds a dominant market position, the likelihood of a monopol contract increases significantly. In such cases, however, the controller’s market position should no longer be evaluated solely in terms of conditionality, but rather under the concept of power imbalance. The market power of the data controller is a crucial factor in evaluating whether a power imbalance exists. Nevertheless, this dimension has not been explicitly addressed in the consent-related guidance issued by either the Article 29 Working Party or the EDPB. As will be explained below, some data protection authorities 38 and the CJEU have stated that a monopolistic/quasi-monopolistic position or dominant position is a key factor in determining whether consent is valid and freely given in Consent or Pay models 39 . 3.2 Perspective of the European Data Protection Board As the Article 29 Working Party, the EDPB has also stated that when options involving the processing or non- processing of personal data are offered, the services must be equivalent and provided by the same service 30. The Article 29 Working Party cites Recital 43 of the GDPR as the justification for this stance see Article 29 Working Party (n 7) 5, 9. EDPB (n 6) paras 13, 16. 31. In fact, during the GDPR reform process, a proposed text included the following sentence in Recital 34, which corresponds to the current Recital 43, but this sentence was later deleted: ‘Consent should not provide a valid legal ground for the processing of personal data, …where the processor or controller is in a dominant market position with respect to the products or services offered to the data subject or where a unilateral and nonessential change in terms of service gives a data subject no option other than to accept the change or abandon an online resource in which they have invested significant time’ available at https://www.europarl.europa.eu/meetdocs/2009_2014/documents/libe/pr/922/922387/922387en.pdf Accessed 28 June 2025. 32. Article 29 Working Party (n 7) 9. 33. Article 29 Working Party (n 7) 10; EDPB (n 6) 11-12. 34. Identifying an equivalent service is inherently challenging. For example, while the services provided by one social network might be available through other networks, a user may choose a particular network primarily because it is used by their social circle. The fundamental reason for this choice is to maintain communication with their social environment. If the user cannot interact with their social circle on a different network, membership in that network would have little significance for them. Therefore, the provision of a service that is fundamentally similar does not necessarily equate to providing the equivalent service from the user’s perspective (Alexander Golland, ‘Das Kopplungsverbot in der Datenschutz-Grundverordnung: Anwendungsbereich, ökonomische Auswirkungen auf Web 2.0-Dienste und Lösungsvorschlag’ (2018) 2 MMR 130, 132-133). As a result, this monopol contract approach will not have a meaningful impact for social networks. 35. Article 29 Working Party (n 7) 10; EDPB (n 6) 11-12. 36. Kai-Uwe Plath (ed), BDSG: Kommentar zum BDSG sowie den Datenschutzbestimmungen des TMG und TKG (Verlag Otto Schmid 2016) DS-GVO Art. 7, para 15. 37. In § 4a of the former German Data Protection Act, which regulates consent, there is no general prohibition of coupling, which corresponds to Art. 7/4 of the GDPR. For the scope and consequences of this provision in the former German Data Protection Act, see also Art. 7/4 GDPR. Stefan Hanloser, ‘BMI: Referentenentwurf für ein Gesetz zur Änderung des Bundesdatenschutzgesetzes und zur Regelung des Datenschutzaudits’ (2008) 12 MMR XIII; Michael Funke, Dogmatik und Voraussetzungen der Datenschutzrechtlichen Einwilligung im Zivilrecht (Nomos 2017) 255; Jürgen Kühling and Benedikt Buchner, ‘DS-GVO Art. 7’ in Manuel Klar and Jürgen Kühling (eds), Datenschutz-Grundverordnung-BDSG Kommentar (3rd edition, C.H. Beck Verlag 2020) para 38. 38. Republik Österreich Datenschutzbehörde, ‘FAQ zum Thema Cookies und Datenschutz’ para 9 https://dsb.gv.at/faqs/datenschutz- cookies Accessed 28 June 2025; see infra 4.3. French Data Protection Authority. 39. See CJEU-C-252/21-Meta Platforms and Others v Bundeskartellamt (n 6) para 154. 342 TechReg 2025.016 Pay or Consent Models in Europe provider 40 . Nevertheless, neither the Article 29 Working Party nor the EDPB has taken a clear position on whether a paid alternative offered by the same service provider can constitute a valid option to consent to personal data processing. Subsequently, however, as discussed below, it became inevitable for the EDPB to address this issue. It should be noted that while the guideline published by the Article 29 Working Party in 2017 specified that both options should be genuinely equivalent and should not incur any additional costs 41 , the review 2018 version of the guideline does not include reference to additional costs 42 . As a result, the question of whether the alternative equivalent service can incur a fee remained unanswered at that time. 3.3 Approach of the Court of Justice of the European Union One of the reasons the Pay or Consent model has become a focal point of debates in data protection law is the assessment made by the Court of Justice of the European Union (CJEU) in relation to the Bundeskartellamt ’s (German Competition Authority) decision on Meta. With this decision, the CJEU has rightly identified two key elements relevant to the assessment of whether consent is freely given in the context of Pay or Consent models: first, the power imbalance between the data controller and the data subject and its impact on the conditionality of consent; and second, the appropriateness of the fee offered as an alternative to consenting to the processing of personal data. The CJEU focused on whether consent can be considered freely given when the operator holds a dominant position in the market for online social networks. This analysis centred on the notions of imbalance of power and conditionality, leading to the following findings 43 : i. The existence of such a dominant position may create a clear imbalance, as described in Recital 43 of the GDPR, between the data subject and the controller 44 . ii. This imbalance may favour the imposition of conditions that are not strictly necessary for the performance of the contract, which must be considered under Article 7(4) of the GDPR. Second, the CJEU, to demonstrate that the consent obtained by the platform is based on free will, proposed a key solution that has since played a significant role in shaping the current debate: “Thus, those users must be free to refuse individually, in the context of the contractual process, to give their consent to particular data processing operations not necessary for the performance of the contract, without being obliged to refrain entirely from using the service offered by the online social network operator. This means that those users are to be offered, if necessary for an appropriate fee, an equivalent alternative not accompanied by such data processing operations” 45 . This “if necessary for an appropriate fee” statement become a point of contention in discussions, particularly in the context of the opinion published by the EDPB concerning the Pay or Consent models, with a focus on large online platforms. This decision demonstrates the first shift at the EU level from focusing mainly on the conditionality criterion, as emphasised by the EDPB and Article 29 Working Party, towards giving more weight to the issues of power imbalance and appropriate fee. However, it is worth noting that even before this decision, some data protection authorities had briefly acknowledged these two factors. The following section will explain how the approach of data protection authorities on this issue has evolved over time. 40. EDPB (n 6) paras 37, 38. 41. Article 29 Working Party (n 7) 10. 42. Article 29 Working Party (n 7) 9, see Eleni Kosta, ‘GDPR Article 7’ in Christopher Kuner, Lee A Bygrave and Christopher Docksey (eds), The EU General Data Protection Regulation (GDPR): A Commentary (OUP 2020) 352. 43. CJEU-C-252/21-Meta Platforms and Others v Bundeskartellamt (n 6) para 149. “The fact that the operator of an online social network holds a dominant position on the market for online social networks does not, as such, preclude the users of such a network from being able validly to consent, within the meaning of Article 4(11) of [the GDPR], to the processing of their personal data by that operator. This is nevertheless an important factor in determining whether the consent was in fact validly and, in particular, freely given, which it is for that operator to prove”. 44. CJEU-C-252/21-Meta Platforms and Others v Bundeskartellamt (n 6) para 154. 45. CJEU-C-252/21-Meta Platforms and Others v Bundeskartellamt (n 6) para 150. 343 TechReg 2025.016 Pay or Consent Models in Europe 4. Assessments of the Online Newspaper’s Pay or Consent Model: Approach of Data Protection Authorities As the Pay or Consent model gains traction in online services, the European Union’s data protection authorities have faced growing challenges in evaluating its compliance with data protection laws. The complaints filed by NOYB on August 13, 2021, targeting the Pay or Consent approach employed by seven major news websites in Germany and Austria, have prompted authorities to conduct further investigations into these practices and their compliance with data protection regulations 46 . Since then, data protection authorities across Europe have issued a range of decisions and statements on the model. To reflect both the jurisdictional diversity and the temporal evolution of regulatory reasoning, this section adopts an authority-by-authority structure. This approach allows for a clearer view of how each authority’s interpretation has developed over time, revealing both common ground and emerging divergences in how freely given consent is understood and applied in practice. 4.1 Austrian Data Protection Authority The Austrian Data Protection Authority ruled in its decision of 30 November 2018 the cookie consent policy of a newspaper website, which offered two different options to the data subject 47 , did not violate the provisions of the GDPR. The Austrian Data Protection Authority has stated that offering membership for a small fee does not disadvantage the data subject, and as such, consent is considered freely given 48 . The Austrian Data Protection Authority has upheld this position in its subsequent decision. In its 2023 decision, the Austrian Data Protection Authority evaluated the newspaper website ( derStandard ) which offered users a choice between a paid service or to be tracked for personalized advertising and some other purposes ( see below Figure 1 ) 49 . (Figure 1. derStandard’s Options for Users) 46. NOYB, ‘News Sites: Readers Need to “Buy Back” Their Own Data at an Exorbitant Price?! Cookie Banners’ (13 August 2021) https://noyb.eu/en/news-sites-readers-need-buy-back-their-own-data-exorbitant-price Accessed 28 June 2025. 47. These options are as follows: (1) Full access to the website with consent to the use of cookies for analytical and advertising purposes; (2) Full access to the website for a monthly fee (€6) without having to agree to the use of cookies. 48. For the full-text of the decision see also Republik Österreich Datenschutzbehörde, DSB-D122.931/0003-DSB/2018, 30 November 2018 https://www.ris.bka.gv.at/Dokumente/Dsk/DSBT_20181130_DSB_D122_931_0003_DSB_2018_00/DSBT_20181130_DSB_ D122_931_0003_DSB_2018_00.pdf Accessed 28 June 2025. 49. Republik Österreich Datenschutzbehörde, D124.4574/2023-0.174.027, 29 March 2023 https://noyb.eu/sites/default/files/2023-04/ Standard_Bescheid_geschw%C3%A4rzt.pdf Accessed 28 June 2025. 344 TechReg 2025.016 Pay or Consent Models in Europe However, in the specific case, the consent was bundled for multiple purposes and was deemed to constitute blanket consent 50 . Therefore, offering only a paid alternative if the consent is structured as blanket consent does render the consent lawful. The authority emphasized the necessity of granular consent, a critical component of freely given consent 51 . In this context, obtaining consent for personalized advertising and ad measurement was deemed appropriate, but separate consent was required for purposes such as website improvement, analysis, and the use of social media plug-ins. Following this ruling, the Austrian Data Protection Authority published FAQ on cookies and data protection, highlighting several key points to be considered in the application of Pay or Consent models 52 . To comply with data protection regulations, such models must ensure granular consent; exclude governmental and public entities; not be available to companies with a public mandate, those providing universal services 53 , or those in a monopolistic or quasi-monopolistic position; offer a reasonably priced paid alternative; and refrain from processing personal data for advertising purposes if the paid option is selected. 4.2 German Data Protection Authorities On March 22, 2023, the German Data Protection Conference ( Konferenz der unabhängigen Datenschutzaufsichtsbehörden des Bundes und der Länder ), which brings together the independent data protection authorities of Germany’s federal and state governments, convened to address the legal and practical implications of subscription models considering data protection compliance 54 . The conference aimed to clarify the conditions required for valid consent, particularly in scenarios where users are presented with the option to deactivate tracking by paying a fee or choosing an alternative service. According to the evaluation notes of the German Data Protection Conference, the validity of consent to be tracked depends on an alternative option (even if for a fee) to deactivate it 55 . It was emphasized that the equivalence between these alternatives could, in principle, be ensured by providing access to the equivalent service (or product) 56 . Moreover, it is accepted that offering a paid alternative cannot justify deviating from the conditions required for valid consent 57 . Consent must therefore contain all the elements necessary for it to be valid. Where there are significantly different processing purposes, consent should be granular, allowing users to actively choose (opt-in) to each purpose for which consent is requested 58 . The importance of granularity, as expressed in the decision of the Austrian Data Protection Authority 59 , has also been highlighted by the German data protection conference. The German data protection authorities did not categorically reject models offering paid subscriptions as an alternative. However, certain implementations were deemed non-compliant because they failed to meet the essential elements required for valid consent as a part of the Pay or Consent Models. 50. It states that consent is obtained collectively for all ‘other processing activities related to the use of many different types of analytical cookies, website optimisation cookies or social media plug-ins’ in addition to behavioural advertising activities. See EDPB (n 6) para 9. 51. In its assessment, the Austrian Data Protection Authority made clear that the possibility of using another news portal was not a suitable alternative, also referring to the opinion of the EDPB. See EDPB (n 6) para 9. 52. EDPB (n 6) para 9. 53. Universal service is a concept developed by the European Union. It refers to the set of general interest demands to which services such as telecommunications and the mail should be subject throughout the EU. The aim is to ensure that all users have access to quality services at an affordable price. available at https://eur-lex.europa.eu/EN/legal-content/glossary/universal-service.html Accessed 28 June 2025. 54. See der Konferenz der unabhängigen Datenschutzaufsichtsbehörden des Bundes und der Länder, 22 March 2023, para 1 https:// www.bfdi.bund.de/SharedDocs/Downloads/DE/DSK/DSKBeschluessePositionspapiere/DSK_20230322-Pur-Abo-Modelle.pdf Accessed 28 June 2025. 55. See der Konferenz der unabhängigen Datenschutzaufsichtsbehörden des Bundes und der Länder (n 54) para 1. 56. The importance of adequate clarity of purpose and transparency of data processing activities is also underlined in the text. See See der Konferenz der unabhängigen Datenschutzaufsichtsbehörden des Bundes und der Länder (n 54) para 2. 57. See der Konferenz der unabhängigen Datenschutzaufsichtsbehörden des Bundes und der Länder (n 54) para 4. 58. See der Konferenz der unabhängigen Datenschutzaufsichtsbehörden des Bundes und der Länder (n 54) para 4. 59. Republik Österreich Datenschutzbehörde (n 49). 345 TechReg 2025.016 Pay or Consent Models in Europe For instance, the Data protection Authority of the Federal State of Lower Saxony ( Niedersachsen ) has assessed the cookie banner displayed upon accessing the news website “www.heise.de”) 60 . The assessment regarding granularity was similar to the Austrian Data Protection Authority’s assessment in the derStandard case. Moreover, the decision stated that although the service provided with consent and the paid service are equivalent in content, the requirements for obtaining consent were not met 61 . The Authority noted that a blanket consent with a paid option, which “ does not even attempt to comply ” with data protection law requirements, cannot be seen as a fair balance between the right to data protection (Charter of Fundamental Rights of the European Union Art. 8) and the freedom of enterprise (Charter of Fundamental Rights of the European Union Art. 16) 62 . In the investigation concerning DER SPIEGEL , which employs a Pay or Consent model offering two options, the Hamburg Data Protection Authority’s three-year inquiry concluded without finding a violation 63 . The Authority’s acceptance of the model as compliant, without providing a detailed explanation of the criteria applied, has been met with significant criticism. Notably, the Authority failed to address the complainant’s assertion that the use of Pay or Consent model results in a consent rate of 99.9% 64 . Moreover, the absence of a published decision makes it challenging to interpret the exact benchmarks used in assessing compliance, if any. In early August 2024, NOYB appealed the authority’s decision to the administrative court, further intensifying debates on the legitimacy of such practices under the GDPR 65 . 4.3 French Data Protection Authority The CNIL has provided guidance on the use of cookie walls and paid alternative models, emphasizing the importance of ensuring equitable alternatives for users who refuse tracking technologies 66 . According to the CNIL, if users decline consent, website operators should offer a genuine and fair alternative for accessing the site without requiring consent to data tracking. If such an alternative is not offered, the operator must demonstrate that another provider offers access to similar content or services without conditioning it on user consent to tracking technologies. The CNIL stresses that imposing consent to trackers as a condition for access may create an imbalance of power between the service provider and users, undermining their freedom of choice. This is especially relevant in cases of exclusivity, such as when the provider is the sole source of specific content (e.g. government services), or when alternatives are limited, as with services from dominant providers 67 . In the CNIL’s assessment of Pay or Consent models, for any payment-based alternative to be valid, the fee must be reasonable and should not deprive users of genuine choice. The CNIL recommends assessing fee levels on a case-by-case basis and suggests transparency, such as publishing the rationale for the fee 68 . If the fee is set so high that the data subject is not considered to have a real alternative, then the consent to obtain the service in exchange for the data will also be considered invalid 69 . 60. Die Landesbeauftragte für den Datenschutz Niedersachsen, 17 May 2023 https://noyb.eu/sites/default/files/2023-07/11Verwarnun gPurAboModellfinalgeschwrztp_Redacted.pdf Accessed 28 June 2025. 61. Die Landesbeauftragte für den Datenschutz Niedersachsen (n 60). 62. Die Landesbeauftragte für den Datenschutz Niedersachsen (n 60) 14. 63. NOYB, ‘“Pay or OK” at DER SPIEGEL: noyb sues Hamburg DPA’ https://noyb.eu/en/pay-or-ok-der-spiegel-noyb-sues-hamburg- dpa Accessed 28 June 2025. 64. Ibid. Please see also full text of compliant, https://noyb.eu/sites/default/files/2021-08/SPIEGEL_Beschwerde_PUBLIC.pdf Accessed 28 June 2025. 65. NOYB (n 63). Taking this a step further, NOYB initiated legal proceedings against the German data protection authorities for their prolonged inaction regarding “Pay or OK” models in North Rhine-Westphalia and Hesse with the Administrative Courts of Wiesbaden and Düsseldorf. See also NOYB, ‘Years of inactivity in “Pay or OK” cases: noyb sues German DPAs’ (17 June 2025) 66. CNIL, ‘Cookie walls: la CNIL publie des premiers critères d’évaluation’ (16 May 2022) https://www.cnil.fr/fr/cookie-walls-la-cnil- publie-des-premiers-criteres-devaluation Accessed 28 June 2025. 67. CNIL (n 66). 68. CNIL (n 66). 69. CNIL (n 66). 346 TechReg 2025.016 Pay or Consent Models in Europe 4.4 The Information Commissioner’s Office The UK Information Commissioner’s Office (ICO) was among the first data protection authorities to investigate the Pay or Consent model, launching an inquiry into the options offered by The Washington Post to its users 70 . Figure 2. Washington Post’ Options for Users The ICO’s investigation concluded that the Washington Post had failed to provide a free alternative to its users and was therefore in breach of data protection rules 71 . This suggests that the ICO’s stance is that a service provider cannot offer a purely paid option as the only alternative to a service that requires user data, as it fails to provide users a genuine free choice. Further, in early 2024, the ICO launched a call for views on the emerging Pay or Consent model. This initiative was driven by increasing debates surrounding ad-funded online business models, recent regulatory developments, and evolving consumer expectations 72 . ICO has published on 23 January 2025 its guidance Consent or pay 73 . The ICO’s perspective appears to have evolved since its decision concerning The Washington Post. This evolving approach reflects a broader shift from a rigid application of consent requirements towards a more contextual and flexible interpretation of data protection principles. 70. The Washington Post was offering users three options for access to the service. These options were as follows: (1) Access to a limited number of articles, subject to accepting cookies and receiving personalised advertising; (2) Basic membership, which requires both paying to access an unlimited number of articles and agreeing to the use of cookies and tracking; (3) Premium membership, which requires a higher fee for access to an unlimited number of articles, but does not require consent to the use of cookies for tracking and behavioural advertising (see supra Figure 2). 71. Visualisation of the membership system https://www.theregister.com/2018/11/19/ico_washington_post Accessed 28 June 2025. 72. The consultation period concluded in April 2024 available at <https://ico.org.uk/about-the-ico/ico-and-stakeholder-consultations/ call-for-views-on-consent-or-pay-business-models/> Accessed 28 June 2025. 73. Information Commissioner's Office, ‘Consent or Pay – About This Guidance’ (UK GDPR guidance, 2025) https://ico.org.uk/ media2/zuogkhyk/consent-or-pay-all-1-0-3.pdf Accessed 28 June 2025. 347 TechReg 2025.016 Pay or Consent Models in Europe The guidance outlines several criteria for determining whether consent is freely given under “Pay or Consent” models. Central to this assessment is the concern that a power imbalance between the service provider and the individual may undermine the validity of consent, particularly where individuals lack a genuine alternative to accessing the service. According to the ICO, the identification of a power imbalance between the data controller and the data subject requires a contextual and multifactorial assessment that considers the overall relationship between the parties 74 . A key indicator is the nature of the organisation itself (e.g. public authorities or employer). 75 The ICO further emphasises that the degree of dependence on the service plays a crucial role 76 . When the service in question is widely used or essential, such as in the domains of finance, communications, or education, the absence of a realistic alternative may compromise the voluntariness of the individual’s consent. Additionally, the organisation’s market position must be considered 77 . Even in the absence of a formal finding of dominance under competition law, the ICO expects data controllers to evaluate whether their market power restricts users’ ability to make a free and informed choice. While the ICO refers to the Competition and Markets Authority’s guidance 78 as a useful resource, it maintains that the responsibility for ensuring valid consent rests with the data controller 79 . The availability of genuinely equivalent alternative services is a critical part of this assessment 80 . An important point to consider is the ICO’s warning that Pay or Consent models may unfairly affect existing users. Because of switching costs and network effects, it is harder for them to reject new terms, making it difficult to give or withhold consent freely 81 . Furthermore, the core service must also remain substantially equivalent across both options. Additionally, a privacy-by-design approach is required to ensure that data subjects are provided with clear, accessible information enabling them to make an informed choice 82 . Lastly, the ICO notes that the fee should be appropriate. The appropriate fee should not be based on general commercial pricing strategies, such as loss of revenue or production costs, but rather must reflect the value that individuals place on preserving their personal data in the context of personalised advertising 83 . 4.5 Emerging Patterns in DPAs Reasoning All four authorities, Austria, Germany, CNIL, and the ICO, acknowledge that Pay or Consent models are not per se unlawful under data protection law. The emphasis by Data Protection Authorities on issues of the other elements of valid consent such as granularity and transparency, rather than on the outright legality of Pay or Consent models, is notably deliberate and not just a mere coincidence. Both the Austrian and German authority’s decisions place particular emphasis on the granularity of consent. Their decisions reject bundled consent mechanisms and require separate, purpose-specific consents, particularly when data processing serves multiple objectives beyond advertising (e.g., analytics, social media plug-ins). This focus on granularity indicates a shared concern about preserving autonomy within complex consent interfaces and serves as a safeguard against coercion disguised as choice. 74. ICO (n 73) 15. 75. ICO (n 73) 13. 76. ICO (n 73) 13. 77. ICO (n 73) 15. 78. Competition and Markets Authority, ‘Digital Markets Competition Regime Guidance’ (CMA 194, 19 December 2024) https:// assets.publishing.service.gov.uk/media/6762f4f6cdb5e64b69e307de/Digital_Markets_Competition_Regime_Guidance.pdf Accessed 28 June 2025. 79. ICO (n 73) 16-17. 80. ICO (n 73) 16-17. 81. ICO (n 73) 18. 82. ICO (n 73) 8. 83. ICO (n 73) 23-24. 348 TechReg 2025.016 Pay or Consent Models in Europe The element of power imbalance is acknowledged by several data protection authorities but often not analysed in depth. The issue is particularly emphasised in contexts involving monopoly or exclusivity. The requirement that a paid alternative must involve an “appropriate fee” appears in the reasoning of the Austrian Data Protection Authority, CNIL, and the ICO. Among these authorities, the ICO offers the most comprehensive analysis, adopting a contextual and multifactorial approach in particular to assess the appropriateness of such fees and power imbalance. Lastly, all data protection authorities emphasise the importance of ensuring equivalence between the ad-funded and paid-for versions of the service. This requirement is crucial to guarantee that users are not penalised for exercising their right to refuse consent and that the choice remains genuine and fair. While the ICO has provided detailed responses to many of the key questions surrounding Pay or Consent models, the same level of clarity is currently lacking at the EU level. Although the ICO’s approach may serve as a helpful reference, it would be more appropriate for the EDPB to issue a dedicated and comprehensive guideline on Pay or Consent models, to promote consistency across the EU. Although the EDPB was expected to provide clear guidance on these fundamental issues, its recent opinion of large online platforms 84 , discussed in the following section, has instead triggered further debate and left significant normative uncertainties unresolved. 5. New Era: Trio Model? In its commentary on the draft principles, the EDPB referred to the CJEU’s Meta rulling of 4 July 2023 85 . The CJEU suggests that users who refuse consent must still have access to the service through an alternative model, even for an appropriate fee, which does not involve the contested data processing. The interpretation of EDPB does not fully capture the scope of the CJEU’s decision. According to EDPB if users decide not to give consent, only storage and accessing of data would be permitted. The CJEU does not explicitly endorse or restrict data processing to storage and access. Instead, the CJEU emphasizes the principle of equivalency and user autonomy, requiring service providers to offer an alternative that respects the user’s decision not to consent to data processing. Notably, the CJEU suggests that users who refuse consent must still have access to the service through an alternative model, such as a paid option, that does not involve the contested data processing which would be likely to involve the processing for advertising purposes. The EDPB in this commentary considers several factors when evaluating the validity of consent, including whether, alongside a service that uses tracking technology and a paid option, there is another type of service available, such as one with less intrusive advertising, like contextual advertising and whether the data subject has a genuine choice 86 . The EDPB reaffirmed this stance in its Opinion 08/2024 on Valid Consent in the context of Pay or Consent models implemented by large online platforms of 17 April 2024 87 . According to EDPB providing solely a paid option for a service alongside the other option of consent to the processing for behavioural advertising should not be the standard practice for data controllers 88 . Instead, when developing an alternative to a service that includes behavioural advertising, data controllers should consider offering data subjects an equivalent alternative 89 that does not require payment, such as a “ Free Alternative Without Behavioural Advertising ” 90 . In this context, examples given by EDPB includes a business model funded by 84. EDPB, ‘Opinion 08/2024 on “Consent or Pay” under the ePrivacy and GDPR frameworks’ (adopted 17 April 2024) paras 24 ff https://www.edpb.europa.eu/system/files/2024-04/edpb_opinion_202408_consentorpay_en.pdf Accessed 28 June 2025. 85. Anu Talus, Chair of the European Data Protection Board, ‘EDPB Reply to the Commission’s Initiative for a Voluntary Business Pledge to Simplify the Management by Consumers of Cookies and Personalised Advertising Choices – Draft Principles’ (Ref. Ares(2023)6863760) 5–6 https://www.edpb.europa.eu/system/files/2023-12/edpb_letter_out20230098_feedback_on_cookie_ pledge_draft_principles_en.pdf Accessed 28 June 2025. 86. Talus (n 85) 5. 87. With increased diversification of paid models and the growing frequency of complaints about these models, the Dutch, Norwegian and German (Hamburg) data protection authorities approached the EDPB for an opinion. Subsequently, the EDPB published Opinion 08/2024 on valid consent in the context of Pay or Consent models implemented by large online platforms. EDPB (n 84) paras 9, 16, 30, 31. 88. EDPB (n 84) para 73. 89. The requirement that services be ‘equivalent’ is also emphasised. See EDPB (n 84) paras 119-120. 90. EDPB (n 84) para 73. 349 TechReg 2025.016 Pay or Consent Models in Europe contextual or generic advertising, or advertising based on topics selected from a list of interests provided by the data subject 91 . Thus, the EDPB’s general approach to Pay or Consent models appears to be based on what we refer to as the “Trio Model”. Nevertheless, it will ultimately be the CJEU that determines whether a proper balance is maintained between the data controller’s freedom of enterprise and the data subject’s right to personal data protection. A decision by the CJEU that either aligns with or evolves from its stance in the Meta ruling will provide further clarity on the matter and guide for future applications. In response to the CJEU ruling on Meta 92 and the EDPB urgent binding decision 93 instructing the Irish Data Protection Authority as lead supervisory authority to take final measures regarding Meta Ireland Limited and to impose a ban on the processing of personal data for behavioural advertising, Meta introduced a subscription-based model for Facebook and Instagram. This model, applicable to users in the EU, EEA, and Switzerland, took effect in November 2023. Under the model, users could either consent to personalised ads and use the service for free or pay for an ad-free version 94 . The introduction of this model sparked significant criticism from various stakeholders. Advocacy organizations such as NOYB argued that the Pay or Consent model undermined GDPR’s requirement for freely given consent 95 . The Commission informed Meta of its preliminary view that the Pay or Consent model breaches the Digital Markets Act 96 . On 23 April 2025, the Commission found that Meta’s “Pay or Consent” model violated the Digital Markets Act between March and November 2024, as it did not offer a genuine alternative based on reduced data use. Consequently, a €200 million fine was imposed on the company 97 . In response to regulatory scrutiny, Meta announced on November 12, 2024, a reduction in the subscription fee for its ad-free service, lowering the monthly cost by approximately 40%. In addition to the price adjustment, Meta plans to introduce a free alternative featuring less personalised advertising that implements short, unskippable ad breaks. Meta’s application to lower subscription fees and offer a less personalised ads option appears to be a strategic response to regulatory pressure. While these changes are still at an early stage, the EDPB has welcomed the shift towards less invasive advertising. EDPB Chair Anu Talus recently described the introduction of a free, less detailed profiling option as a positive step, though one that still warrants further evaluation 98 . While Meta has characterized its changes as going “ beyond what is legally required ”, NOYB 91. EDPB (n 84) para 75. See also Vittorio Bachelet, ‘“Pay-or-Consent” and Emerging Trends in Digital Contract Law’ (2024) 5 European Review of Private Law https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4950785 Accessed 28 June 2025. According to the Bachelet , the EDPB’s position contrasts with the CJEU’s interpretation and raises serious concerns regarding its potential implications for entrepreneurial freedom, as it appears to disregard the commercial viability of providing such an additional option. See also Bachelet (n 91) 21. 92. CJEU-C-252/21-Meta Platforms and Others v Bundeskartellamt (n 6) para 150. 93. EDPB, ‘EDPB Urgent Binding Decision on Processing of Personal Data for Behavioural Advertising by Meta’ (1 November 2023) https:// www.edpb.europa.eu/news/news/2023/edpb-urgent-binding-decision-processing-personal-data-behavioural-advertising-meta_en Accessed 28 June 2025. 94. Meta, ‘Facebook and Instagram to Offer Subscription for No Ads in Europe’ (30 October 2023) https://about.fb.com/ news/2024/11/facebook-and-instagram-to-offer-subscription-for-no-ads-in-europe Accessed 28 June 2025. 95. NOYB, ‘Noyb files GDPR complaint against Meta over “Pay or Okay”’ (28 November 2023) https://noyb.eu/en/noyb-files-gdpr- complaint-against-meta-over-pay-or-okay Accessed 28 June 2025. 96. The Commission, ‘Commission sends preliminary findings to Meta over its “Pay or Consent” model for breach of the Digital Markets Act’ (1 June 2024) https://digital-strategy.ec.europa.eu/en/news/commission-sends-preliminary-findings-meta-over-its- pay-or-consent-model-breach-digital-markets-act Accessed 28 June 2025. 97. European Commission, ‘Commission finds Apple and Meta in breach of the Digital Markets Act’ (Press Release, 23 April 2025) https://ec.europa.eu/commission/presscorner/detail/en/ip_25_1085 Accessed 28 June 2025. 98. EDPB, ‘“Consent or Pay” Models - Reaction by Anu Talus, Chair of the EDPB’ https://www.linkedin.com/posts/eu-edpb_consent- or-pay-models-reaction-by-anu-activity-7262091178492182529-U-00 Accessed 28 June 2025. 350 TechReg 2025.016 Pay or Consent Models in Europe promptly issued a critical response 99 . The further evaluations by the EDPB and the European Commission, particularly concerning the new subscription fees and the less ads version, will play a crucial role in determining whether this approach secures regulatory approval. 6. Reflections: The Early Fallacy? The evaluation of Pay or Consent models remains a complex issue, as highlighted by the EDPB and various Data Protection Authorities. A “one-size-fits-all” approach is infeasible, necessitating case-by- case assessments. There are, in fact, several criteria that may be considered when assessing the legal compliance of Pay or Consent models. These include: the power imbalance between the service provider and the individual; the appropriateness of the fee charged for accessing the service without personalised advertising; the equivalence of the core service; the granularity of consent; the exclusion of certain sectors (e.g., public authorities or entities with public mandates); the proper application of the transparency principle; the integration of privacy by design principle; and, where the service targets vulnerable groups, the implementation of specific safeguards for their protection. However, many of the problems regarding these elements are not unique to Pay or Consent models and are equally relevant to systems that rely on consent more broadly. For example, issues concerning granularity and transparency are inherent in most consent- based frameworks and similarly arise within Pay or Consent models. Moreover, as reflected in the above discussions and regulatory developments, conditionality has been considered not as a stand-alone criterion but as one that is inherently linked to the broader evaluation of power imbalance and the appropriateness of the fee. Against this background two elements stand out in relation to Pay or Consent models, which are examined in this article with a focus on the question of whether consent is given freely: the power imbalance and the appropriateness of the fee charged. 6.1 The Power Imbalance EDPB’s suggestion of the Trio Model, primarily focusing on large online platforms, has added complexity to the current debate on Pay or Consent models, especially as it has not yet issued comprehensive guidelines on Pay or Consent practices, including for news websites. The EDPB defines large online platforms as platforms that attract many data subjects as users 100 . It states that the company’s position in the market is a factor that is relevant in determining whether a controller qualifies as a large online platform 101 . Another important criterion is whether the controller engages in large-scale data processing 102 . For large online platforms, the central issue lies in the potential impact of their power imbalance on the free will component of consent, as highlighted by the CJEU in Meta decision. However, it is not clear why the EDPB introduced large online platform as a distinct criterion on which to base a comprehensive opinion regarding Pay or Consent models. For a consent-based assessment, it would have been more appropriate to adopt a framework centered on power imbalance as in the ICO’s Guidance on Consent or Pay models. Within such a structure, the concept of large online platforms could have been more coherently integrated into the broader and more principled concern of structural inequality between data subjects and controllers. Moreover, the EDPB’s statement that “ The factors highlighted in this Opinion will typically apply to large online platforms, but not exclusively ” raises questions about whether the Pay and Consent model is already outdated, and the Trio Model should serve as a viable alternative for other providers as well. 99. NOYB, ‘Ads: Meta wants to be “less illegal” - but much more annoying...’ (12 November 2024) https://noyb.eu/en/ads-meta- wants-be-less-illegal-much-more-annoying Accessed 28 June 2025. 100. EDPB (n 84) para 25. 101. EDPB (n 84) para 26. 102. EDPB (n 84) para 27. 351 TechReg 2025.016 Pay or Consent Models in Europe Online newspapers, while not typically dominant in the market from a competition law perspective, may nevertheless give rise to a form of practical dependency, particularly when they serve as primary sources of news or public interest content. In this regard, online newspapers must carefully and rigorously assess whether such a power imbalance exists. For other online newspapers, the key point of contention revolves mostly around the determination of a appropriateness fee, which could be perceived as detrimental to users. By contrast, social networking platforms often hold a dominant or near-dominant market position, thereby contributing to a more evident and structural power imbalance. Individuals’ strong reliance on these platforms for communication, social interaction, and professional engagement significantly limits their capacity to refuse consent without experiencing detriment. In situations where a power imbalance exists, data controllers should ensure that users are provided with a genuine and meaningful choice. To this end, controllers may offer an additional alternative, such as a version of the service without advertising or limited to contextual advertising 103 . Alternatively, facilitating the transfer of personal data to another provider offering a comparable product or service, in accordance with the right to data portability, may also serve to enhance user autonomy and choice 104 . 6.2 Appropriate Fee 6.2.1 Existing Research on Pay or Consent Models and User Behaviour There is currently insufficient empirical evidence on how to identify an appropriate fee that does not unduly influence an individual’s consent in Pay or Consent models. Research on appropriate fee remains scarce, with only a handful of studies. A study shows that 99% of users prefer the tracking to the pay options 105 . The study found that publishers set the payment option higher than the revenue they would receive from behavioural advertising, so as not to lose money 106 . Another study notes that when contacting the CEO of ContentPass to gain a better understanding of their solution, it was revealed that 99.9% of visitors consent when encountering a ContentPass paywall 107 . According to the authors, despite - an average price of €3.34- a reasonable price, most of the users still opted for the tracking model 108 . Another study focusing on the types, prevalence, and legality of paywalls and cookie walls manually classified 2800 popular websites across 13 Central European countries 109 . According to this study users pay between €2.99 and €6.25 for monthly subscriptions for cookie paywalls in general. Authors considered that reasonable compared to the average monthly price of an online newspaper subscription (€14.06) 110 . Recent research explores how users make decisions when confronted with Pay or Consent models, specifically investigating users’ perceptions, expectations, and the factors that may influence their willingness to pay 111 . According to the study, the most perceived purpose of cookie paywalls was to generate revenue for the websites, rather than protection of users’ privacy 112 . The study identified several key factors influencing users’ decisions regarding cookie paywalls. The most common reason for such models was access to exclusive 103. ICO (n 73) 19. 104. ICO (n 73) 19. 105. Müller-Tribbensee et al (n 15) 37. 106. Müller-Tribbensee et al (n 15) 36. 107. Victor Morel, Cristiana Santos, Viktor Fredholm and Adam Thunberg, ‘Legitimate Interest is the New Consent - Large-Scale Measurement and Legal Compliance of IAB Europe TCF Paywalls’ (WPES ‘23: Proceedings of the 22nd Workshop on Privacy in the Electronic Society, 26 November 2023) 155 https://dl.acm.org/doi/10.1145/3603216.3624966 Accessed 28 June 2025. 108. Morel et al (n 107) 153. 109. Victor Morel, Cristiana Santos, Yvonne Lintao and Soheil Human, ‘Your Consent Is Worth 75 Euros a Year - Measurement and Lawfulness of Cookie Paywalls’ in Proceedings of the 21st Workshop on Privacy in the Electronic Society (ACM, Los Angeles, November 2022). The scope of the research was determined using the Tranco ranking system. Tranco is a ranking tool used to measure and list the popularity of websites. This ranking is created by combining traffic and access statistics from various data sources. For the research, a list based on the Tranco ranking was prepared for the period between March 27 and April 25, 2022. 110. Morel et al (n 109) 216. 111. Morel et al (n 109) 216. 112. Victor Morel, Farzaneh Karegar and Cristiana Santos, ‘“I will never pay for this”: Perceptions of Fairness and Factors Affecting Behaviour on “Pay-or-OK” Models’ (arXiv, 23 May 2025) 6-7 and 13 https://arxiv.org/abs/2505.12892 Accessed 28 June 2025. 352 TechReg 2025.016 Pay or Consent Models in Europe content or services. Many participants expressed a general refusal to pay for cookie paywalls under any circumstances 113 . However, fair/cheap pricing increased willingness to pay 114 . The authors found that users’ willingness to pay for cookie paywalls is closely linked to their financial resources. As a result, according to them, the scalability of the model appears questionable, as it is unlikely that users would be willing or able to pay for access to multiple websites or services if such paywalls became widespread. The authors conclude that cookie paywalls risk introducing or reinforcing socioeconomic discrimination 115 . As a result, the authors express that in favour of an explicit prohibition of this model by regulation 116 . We share the authors’ concern regarding the risk of creating a two-tiered society, divided between those who can afford meaningful data protection and those who cannot. However, in our view, it is still premature to completely dismiss this model or replace it with a Trio Model. Where the pay option is framed as reflecting the value that individuals place on preserving their personal data in the context of personalised advertising, we believe that some of the criticisms directed at the Pay and Consent model may potentially be addressed 117 . As recommended by the ICO, data controllers should engage in an evidence-based assessment of how users value their personal data 118 . This evaluation may rely on existing empirical research into consumer attitudes, including both users stated preferences regarding privacy and their actual behaviour when faced with privacy-related choices. Accordingly, the ICO notes that a discrepancy between these may indicate the presence of manipulative or coercive interface designs implemented by data controllers 119 . Although this assessment rests with the data controller, further research is still needed in this area. Such research should aim to fill key empirical gap that directly affect the legal assessment of Pay or Consent models. More granular studies on pricing models, opt-in rates, and the perceived value of services could provide regulators with evidence-based benchmarks for evaluating the legality of these models. Taken together, the findings indicate that further empirical research is necessary to ascertain whether monetary payment constitutes a fair alternative in Pay or Consent models 120 . 6.2.2 Regulatory Shortcomings and Unclear Criteria for Appropriate Fees According to the EDPB, when data controllers offer a paid alternative to services involving behavioural advertising that requires consent for personal data processing, they must ensure that the fee neither discourages data subjects from withholding consent nor coerces them into feeling compelled to provide consent 121 . Although this statement explains that the fee should not be coercive, it is still far from providing a roadmap or method regarding what constitutes an appropriate fee. Moreover, concerns expressed by NOYB 122 regarding appropriateness of the fee are not adequately reflected in the approaches of data protection authorities. In many cases, these authorities’ decisions have either failed to address the issue comprehensively or have done so in a manner that is highly critical. For instance, the Austrian Data Protection Authority concluded that a subscription fee of €6 per month, starting from the second month, did not constitute an excessively expensive alternative, albeit without establishing explicit criteria for such determination. 123 . Similarly, neither the Austrian Data Protection Authority in subsequent decisions nor the CNIL has provided clear criteria for what constitutes an appropriate price. Given that the criteria for determining a appropriate price have not yet been clearly defined in these models, reliable 113. Morel et al (n 112) 10-11. 114. Morel et al (n 112) 11. 115. Morel et al (n 112) 16. See also Grafenstein et al (n 7) 55. 116. Morel et al (n 112) 16 117. See below. 6.2.3 (Calculation of Appropriate Fee). 118. ICO (n 73) 24. 119. ICO (n 73) 24. 120. See also Alessia Sophia D’Amico, Dionysios Pelekis, Cristiana Santos and Bram Duivenvoorde, Meta’s Pay-or-Okay Model: An Analysis Under EU Data Protection, Consumer, and Competition Law, (2024) Technology and Regulation 264, https://techreg.org/ article/view/19031 Accessed 28 June 2025. 121. EDPB (n 84) para 134. 122. See NOYB, ‘Complaint to the Austrian DPA against Meta under Article 77(1) GDPR’ (28 November 2023) https://noyb.eu/sites/ default/files/2023-11/Complaint%20-%20Meta%20Pay%20or%20Okay%20-%20REDACTED.pdf Accessed 28 June 2025. 123. Republik Österreich Datenschutzbehörde (n 48). 353 TechReg 2025.016 Pay or Consent Models in Europe data on the impact of price on free will remains missing. Hence, it is premature to endorse the Trio Model without sufficiently clarifying the question of appropriate fee for all online services 124 . 6.2.3 Calculation of Appropriate Fee In the context of “Pay or Consent” models, four potential approaches to pricing have been discussed by NOYB 125 . The first approach advocates for a fee that does not significantly influence users’ consent decisions 126 . Under this framework, the appropriateness of the fee depends on its neutrality in affecting user choice. Data controllers must demonstrate that the fee does not have a statistically significant effect on whether individuals’ consent, either generally or in specific cases (e.g. among those with limited financial resources). The second involves a fee level that remains affordable, even when Pay or Consent models become widespread across digital services 127 . The third approach involves setting a price that covers only the operational costs of the service, plus a modest and fair profit margin. This focuses on cost recovery rather than profit maximization 128 . The fourth approach ties the price to the loss of revenue resulting from the user’s refusal to consent, i.e. the cost of lost advertising income 129 . While the first and the second model is more consistent with data protection principles, the ICO seems to rather endorse the first approach. As the ICO appropriately highlights, the fee should not be determined by standard commercial considerations, such as potential revenue loss or production expenses, but should instead be grounded in the value individuals assign to safeguarding their personal data, particularly in the context of personalised advertising 130 . Although it can be easily asserted in abstract terms that the fee should be determined based on the value individuals place on safeguarding their personal data, there is currently no concrete method for how this value can be measured or how the fee can be set. As for the second method, NOYB highlighted that if Pay or Consent models became more widespread and each of the apps installed on a user’s device applied a fee comparable to the rate set by Meta’s Pay or Consent model at the time, this would amount to an annual cost of €8,815.80, which would be difficult for individuals to afford. This calculation is based on the fact that an individual has on average, 35 apps installed on their mobile device 131 . Apparently, this concern has also been raised by some respondents to the ICO’s Call for Views on Pay or Consent models. Respondents have emphasized that the development of Pay or Consent models in the market should be considered as a whole, rather than focusing solely on an individual’s relationship with a single data controller 132 . However, it should be noted that such a scenario is rather unlikely, as some of these applications do not charge any fee at all, while others already impose fees independent of data protection considerations 133 . Therefore, the accuracy and practical relevance of this calculation is questionable. On the other hand, if such a situation were to materialize, consumers would likely be forced to prioritize the services they use and make choices based on their financial means 134 . 124. According to one approach, although contextual advertising is less intrusive, it is also less profitable compared to personalized tracking ads and therefore cannot fully replace the fee. As an alternative to paying the full fee for a completely ad-free experience, other paid options, such as a version with only contextual advertising and a lower fee, should also be offered to the user. According to this approach, it is possible to set a fee for all alternatives except the option where full consent is given for the processing of all personal data for personalized advertising. See also Bachelet (n 91) 24. 125. NOYB (n 123). See also Golland (n 34) 134; Niclas Krohm and Philipp Müller-Peltzer, ‘Auswirkungen des Kopplungsverbots auf die Praxistauglichkeit der Einwilligung: Das Aus für das Modell “Service gegen Daten”?’ (2017) ZD 551, 553. Nikolas Guggenberger, ‘Consent as Friction’ (2025) 66 Boston College Law Review 353 https://ssrn.com/abstract=4938421 or http://dx.doi.org/10.2139/ ssrn.4938421 Accessed 28 June 2025. 126. NOYB (n 122) paras 25 ff and 40 ff. 127. NOYB (n 122) para 44. 128. NOYB (n 122) para 45. 129. NOYB (n 122) para 46. 130. ICO (n 73) 23-24. 131. NOYB (n 122) para 44 132. ICO (n 73) 25. 133. Bachelet (n 91) 22. 134. Bachelet (n 91) 22. 354 TechReg 2025.016 Pay or Consent Models in Europe Nevertheless, this development could raise serious concerns regarding equal access to digital services and the broader implications for digital inclusion. Similarly, restricting access to all high-quality, independent journalism through paywalls could fundamentally compromise access to information and weaken democratic participation 135 . This suggests that application of the second method may lead to a sounder and more reliable outcome. Consequently, future research should focus on three key areas (a) establishing the method for determining what constitutes an appropriate fee; (b) assessing whether data subjects are willing to consent despite the existence of an appropriate fee; and (c) evaluating the user’s choice between personalized, less personalized ads and paid options. Only through these evaluations can it be determined which model -Pay or Consent or Trio-better facilitates empowerment and helps identify individuals’ reasonable expectations. 7. Concluding Remarks The paper critically assesses the emerging “Pay or Consent” model not merely in terms of its formal legality, but in the light of whether current legal and regulatory debates are addressing the most structurally significant challenges, such as power imbalance and the appropriateness of the fee. Rather than imposing a one-size-fits-all regulatory template, the paper advocates for context-sensitive assessments that particularly account for the provider’s market power and the appropriateness of the fee charged. The introduction of the Trio Model by the EDPB, which primarily targets large online platforms, is questioned for its selective focus. EDPB’s approach would have been more coherent had it addressed large online platforms as part of the broader structural power imbalance, rather than introducing them as a distinct criterion - a move that also represents a departure from the general approach of the European data protection authorities. Current regulatory efforts offer little guidance on what qualifies as an “appropriate” fee, raising the risk of socio-economic exclusion and reinforcing digital inequality. The fee should not be determined by standard commercial considerations, such as potential revenue loss or production expenses, but should instead be grounded in the value individuals attach to safeguarding their personal data. Data controllers and regulators alike must invest in evidence-based evaluations, examining how users perceive, value, and act upon privacy- related choices. Only then can the Pay or Consent debate move beyond abstract principles to address the practical challenges of safeguarding privacy in an increasingly monetised digital environment. 135. European Commission, Directorate-General for Communications Networks, Content and Technology, Study on the Impact of Recent Developments in Digital Advertising on Privacy, Publishers and Advertisers – Final Report (Publications Office of the European Union 2023) 183. Copyright (c) 2025, Nafiye Yücedağ, Elif Beyza Akkanat Öztürk, Şehriban İpek Aşıkoğlu. Creative Commons License This work is licensed under a Creative Commons Attribution- Non-Commercial-NoDerivatives 4.0 International License.